A PHP security emergency knocked a string of game services offline on October 21, 2026. The PHP project shipped fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. Within hours, Pokémon Sleep, Cygames titles such as Umamusume: Pretty Derby and Granblue Fantasy, and the DRM-free store GOG all went into emergency maintenance.
There is a calming and an unsettling reading of this. The calming one: nobody has reported that any game company was breached, and the outages look like operators pulling servers before attackers could use the bugs. The unsettling one: the PHP team says there is no complete workaround, and several services (Pokémon Home, Champions) were still dark at the time of the reports we could verify. Below is what is confirmed, what is reported, and what you can actually do.
TL;DR: why are games offline?
| Question | Short answer |
|---|---|
| What happened? | PHP released fixes for two critical RCE bugs on Oct 21, 2026; game services went into emergency maintenance to patch. |
| How bad is the bug? | Both are rated CVSS v4.0 9.2; the PHP team says they can allow unauthenticated remote code execution. |
| Which games are down? | Pokémon Sleep, Home and Champions; Cygames' Umamusume, Granblue Fantasy, Princess Connect! Re:Dive; Shadowverse: Worlds Beyond; CHUNITHM; GOG (back after about four hours). |
| Were players hacked? | No breach confirmed. Dexerto stresses the outages do not mean every listed service was hacked. |
| Is Nintendo confirmed as affected? | No. Nintendo has not confirmed that reported maintenance is tied to PHP. |
| When is it back? | Pokémon: no estimate. Others vary; check official status accounts. |
| What can I do? | Wait, avoid phishing, use official status pages, and secure your accounts. |
What did the PHP team actually announce?
The primary source is the PHP project's own announcement at php.net. It had given advance notice of a security release scheduled for Wednesday, October 21, 2026 at 14:00 UTC, saying it "addresses two critical vulnerabilities, both rated CVSS v4.0 9.2." The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Its summary of risk is unambiguous:
"PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately."
The team lists who is exposed: "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed," with the highest risk for mod_php, "with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs."
The two bugs, in the team's words:
- CVE-2026-109618, "RCE via OOM corruption": out-of-memory handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat invalid data as valid.
- CVE-2026-109619, "RCE via stale global state": request-owned internal state can survive after its backing memory is freed, and a later request handled by the same worker may use that stale state.
On workarounds, the release notes say bluntly: "There are no complete mitigations, updating is the only safe choice." PHP 8.1 and older no longer receive updates from the project; the team did provide minimal source backports for PHP 7.4, 8.0 and 8.1, and noted Linux distributions and LTS vendors received patches in advance.
Which games and services went offline?
The reporting is split across several outlets, so here is what each says and how sure we are.
| Service | What was reported | Source and confidence |
|---|---|---|
| Pokémon Sleep | Emergency maintenance from 14:00 UTC on Oct 21, no end time | Serebii, via Dexerto. Announced by the game. |
| Pokémon Home, Pokémon Champions | Reported in emergency maintenance; Home is used for transfers | Serebii and players, via Dexerto. Not confirmed by Nintendo or The Pokémon Company. |
| Nintendo Switch 1 and 2 online services | Reported by players as in maintenance | Dexerto relays a player report; not confirmed as PHP-related. |
| Umamusume: Pretty Derby | Official notice said a PHP vulnerability was identified in its servers | Dexerto, citing the game's notice. Confirmed by the publisher. |
| Granblue Fantasy, Princess Connect! Re:Dive | Similar maintenance notices from Cygames | Dexerto. |
| Shadowverse: Worlds Beyond | Maintenance reportedly linked to the same issue by Japanese tech outlets | Dexerto. Treat as reported. |
| CHUNITHM (international) | Warned that a PHP vulnerability was reported and emergency maintenance would follow | Dexerto, via the game's account. |
| GOG and GOG Galaxy | Offline "for a couple of hours" from 8 am Pacific; back about four hours later | PC Gamer, quoting GOG's posts. |
PC Gamer also relays that the government of Finland took websites down as a precaution and that players reported Final Fantasy 14 login servers being down. Those are reports, not statements from the companies.
On GOG, the store did not name a cause when it went offline, and PC Gamer called the link "not hard to speculate." When it returned, GOG posted: "We're back online. Thanks for your patience! Your DRM-free library is right where you left it."
Are my game accounts safe?
Nobody has reported a breach of the games above. The honest framing is a patch-before-exploit race. Dexerto's reading is that "the outages do not mean that every listed service has been hacked. In several cases, developers appear to be taking their servers offline to apply patches or prevent potential attacks."
Why take a game offline at all? PHP runs on the server side of many web-facing parts of games: logins, account pages, stores, and companion apps. As Dexerto puts it, "players do not run PHP directly on their consoles or phones. Instead, it operates on servers that handle logins, account information, purchases and other online features." A remote-code-execution bug on such a server could let an attacker alter a site, steal data or run commands, so shutting the door is the cautious play when a fix is only just available.
One caution on the claim that every PHP version is affected: TheGamer says the flaws could affect versions back to PHP 5, hedging with "apparently." The PHP project's own statement lists 8.2 to 8.5 as the fixed lines plus source backports for older ones, so we would not repeat the PHP 5 claim as fact.
Why is it taking so long for Pokémon to come back?
We do not know. TheGamer reported the three Pokémon games had been offline for about 12 hours at the time of writing, with the games showing "maintenance" while the real reason was security fixes, and said they would stay offline until The Pokémon Company can "unequivocally confirm that it's safe to do so." That is TheGamer's characterisation, not a company statement. Nintendo has not confirmed the link between its maintenance and PHP.
A plausible reason for a slower recovery than GOG's four hours: a large interconnected platform such as Pokémon Home talks to multiple games and services, and patching one server layer means re-testing the others. That is our inference; no company has said it.
If the outage hits your plans, remember that Home transfers matter for Champions: Dexerto notes that Pokémon Champions relies on Home for some of its transfer features.
What should you do as a player?
- Wait, then check official channels. Use each game's official status account or in-game notice for return times. Don't rely on third-party "is it down" pages for ETA.
- Be suspicious of recovery emails and links. Outages are prime time for phishing. Don't click messages claiming to "restore" or "verify" your account; go to the app or site directly.
- Make sure your passwords are unique. If you reuse a password across a game account and anything else, change it now. Turn on two-factor authentication where offered.
- Don't try to work around maintenance. Third-party tools or "mirror" servers are a bad idea in the middle of a security incident.
- Expect more notices this week. Operators of web-facing services patch in waves; other games with web back-ends may announce short maintenance windows. We'll update if major titles confirm.
- If you run your own server, the PHP team's guidance is to update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart workers. Check the php.net notice for the partial mitigations it lists if you truly can't update yet.
What does this say about browser and web-based games?
The games hit hardest here are ones that are, at heart, web services with a game client on top. The same applies to browser games: the page you load, the account system, the lobby and the leaderboard live on web servers somebody has to patch. That is a reason to prefer services that say plainly what they run and how quickly they respond, and it's a fair question to ask of any group game tool you use for team events. If you are organising a Friday game hour and your usual platform is down, bunpav's /play page and team-building page list free browser games a group can start without installs, though we would not call any web service immune to bugs like these. For more on browser-game culture, see our piece on friendslop browser games.
Other game news today
World of Warcraft: Forever's beta is extended to Friday. Associate production director Clayton Stone announced the extension on X, and Blizzard is running a server stress test that includes players who otherwise wouldn't have beta access, per Eurogamer. Character name reservation opens next week, and full launch is November 4.
Xbox Series X|S is getting AMD FSR 4.1. AMD announced the AI upscaler is coming to Xbox Series X, Series S, ROG Ally and Ally X, with no date given. Xbox CTO Scott Van Vliet said the company has "worked very closely with AMD to optimise this technology," per Eurogamer's report. The bigger gains are expected on Series S and the handhelds.
EA is closing BioWare. The restructuring announced October 21 also cancels the next Mass Effect; we have the full breakdown in our BioWare closure explainer.
Related reading
- EA is closing BioWare and cancelling Mass Effect 5
- Friendslop browser games: bring the chaos to your team social
- Helldivers 2, Easy Anti-Cheat and the live-service patch cycle
- Fortnite is coming to Linux: what Epic actually said
- Steam hits 43.5 million concurrent users
- PHP project: security release announcement
- Dexerto: Pokémon, Umamusume and other major games taken offline
- PC Gamer: GOG taken offline in wake of PHP security emergency
- TheGamer: Why Pokémon Champions, Home and Sleep are down
Facts are accurate as of October 22, 2026. Service status is changing quickly; Nintendo and The Pokémon Company had not confirmed the cause or a return time when the sources above were published. Check each game's official status account before acting.